From ef5b718cf81a2448118b86b86777f9430739445d Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 13 Oct 2025 16:50:01 +0200 Subject: [PATCH] VT-d: check bus_to_context_maddr()'s return value The function returning zero is an error indication; we shouldn't try to map MFN 0 and then treat that page as a context table. Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-Acked-by: Oleksii Kurochko --- xen/drivers/passthrough/vtd/iommu.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c index b4105163cc..90f36ac22b 100644 --- a/xen/drivers/passthrough/vtd/iommu.c +++ b/xen/drivers/passthrough/vtd/iommu.c @@ -1499,6 +1499,11 @@ int domain_context_mapping_one( ASSERT(pcidevs_locked()); spin_lock(&iommu->lock); maddr = bus_to_context_maddr(iommu, bus); + if ( !maddr ) + { + spin_unlock(&iommu->lock); + return -ENOMEM; + } context_entries = (struct context_entry *)map_vtd_domain_page(maddr); context = &context_entries[devfn]; old = (lctxt = *context).full; @@ -1853,6 +1858,12 @@ int domain_context_unmap_one( spin_lock(&iommu->lock); maddr = bus_to_context_maddr(iommu, bus); + if ( !maddr ) + { + ASSERT_UNREACHABLE(); + spin_unlock(&iommu->lock); + return 0; + } context_entries = (struct context_entry *)map_vtd_domain_page(maddr); context = &context_entries[devfn];